Re: The art of negotiation and trust in IPSEC

From: Hans (anonymous_at_discussions.microsoft.com)
Date: 02/13/04 

Date: Fri, 13 Feb 2004 09:56:05 -0800

Thanks for the links!

To clarify, if I have two machines that are not members of any Domain, and they have IPSEC enabled via a the security policy (client/respond) - so will the machines be able to talk IPSEC with each other?

Or do they still need to have a 3rd party (Active Directory or Cert. Auth (or preshared key)) to authenticate/validate the enpoints of the IPSEC conversation?

So what I want (in my imaginary world) is to have two machines talk IPSEC with a third party or prior knowledge of each other.

What do you think?!

Thanks much in advance for the advice and info!

Hans

     
     ----- Steven Umbach wrote: -----
     
     The XP/W2K will not respond with secured ipsec unless it has at least the
     client/respond policy enabled in security policy. Kerberos is used within a
     forest as the machine authentication method for ipsec. You can easily distribute
     machine certificates in an AD domain if you have an Enterprise Certificate
     Authority for the domain. You can even use Group Policy to autoenroll computer
     certificates in W2K. When not in a domain it becomes more difficult and involves
     Web Enrollment after the offline ipsec template is enabled. See links below for
     more information. --- Steve
     
     http://www.microsoft.com/windows2000/techinfo/planning/security/ipsecsteps.asp
     http://www.microsoft.com/WINDOWS2000/techinfo/planning/security/autocertsteps.asp
     http://support.microsoft.com/default.aspx?scid=kb;en-us;253498
     
     
     "Hans" <hej107us@yahoo.com> wrote in message
     news:D0C7BAEE-B7D9-4F80-B708-99347B66FA00@microsoft.com...
> So if I have an XP machine, and it tries to communicate with a server. If
     that server wants to talk IPSEC and initiates a negotiation - will the XP
     machine respond and negotiate? Even if it has no explicit policies defined?
>> I guess it comes down to trust, yes?
>> You have to trust another computer to even BEGIN to negotiate, is that
     correct?
>> And this is done by 1 of 3 methods (Kerberos, certificate, or shared secret).
>> Perhaps I've answered my own question. Is there an easy way to deploy
     certficiates via AD or without AD (scripting, file copying deployment - or does
     it have to be registerd)?
>> I suppose that's enough questions for one post.
>> Thanks in advance,
>> Hans
     
     
     

Relevant Pages

  • Re: Should I install Certificate Authority to solve these problems ?
    ... there are multiple considerations for IPsec. ... "trust" is defined as the ability to authenticate with IKE; ... constrain the use of certificates for IPsec authN to ... > base it on Kerberos you pretty much limit hard binding ...
    (microsoft.public.win2000.security)
  • Re: Kerberos Question
    ... However if you use ipsec negotiation within the domain by ... default kerberos computer authentication will be used and required. ... >> Security Policy and Domain Controller Security Policy and disable storage ...
    (microsoft.public.windows.server.security)
  • Tunnel mode IPSec in Win2k
    ... I'm trying to set up a "client" win2k box to talk to a LAN over ipsec. ... Something like this (cue bad ascii diagram) ... if there wasn't a filter, ... Local IPSec Policy Active: 'New IP Security Policy' ...
    (microsoft.public.win2000.networking)
  • IP Security Policy was: Re: Simple software firewalls for Windows 2000 Server
    ... > I know about IPSec and am using it. ... Speaking of IP Security Policy, ... (There's a theorem in formal logic that if you have an axiom that "the more ... What I *like* about IP Security Policy is that very specific rules can be ...
    (comp.security.firewalls)
  • Re: IPSec
    ... > What service/component provides it? ... One may most conveniently use IPsec via the two upper ... Local Security Policy. ... >> The Windows IPsec does implement the IPsec protocols. ...
    (microsoft.public.windowsxp.security_admin)